Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

A Simplex Architecture for Intelligent and Safe Unmanned Aerial Vehicles


Published on

Slides for our paper "A Simplex Architecture for Intelligent and Safe Unmanned Aerial Vehicles," published at RTCSA 2016

Published in: Engineering
  • Be the first to comment

  • Be the first to like this

A Simplex Architecture for Intelligent and Safe Unmanned Aerial Vehicles

  1. 1. A Simplex Architecture for Intelligent and Safe Unmanned Aerial Vehicles Prasanth Vivekanandan+, Gonzalo Garcia*, Heechul Yun+, Shawn Keshmiri* Electrical Engineering and Computer Science + Aerospace Engineering * University of Kansas 1
  2. 2. Intelligent UAVs • Many applications – Commercial, military, police,… – $10B in 3 years* 2 (*) Amazon prime airFollow me Search & rescuesurveillance
  3. 3. Intelligent UAVs • Powerful computer hardware – Multicore SoC, GPU • High performance, Low cost, size, weight, and power • Powerful software framework – Linux, middleware, libraries • Productivity, ease of development – Like a PC 3
  4. 4. Safety Challenges UAVs are safety critical systems 4 ne-narrowly-misses-top-skiier/ ouse-drone.html
  5. 5. Sources of Failures • Sensors • Airframe • Actuators • Onboard computing platform – Software – Hardware 5
  6. 6. Safety Challenges: Software • Increasing complexity – E.g., Linux: > 15M SLOC • Concurrency – Multithreading is hard • Race condition. Order violation • Timing unpredictability – Shared resource contention affects timing • >21X slowdown on a cache partitioned multicore (*)  Software bugs are hard to weed out 6 (*) Prathap Kumar Valsan, Heechul Yun, Farzad Farshchi. Taming Non-blocking Caches to Improve Isolation in Multicore Real-Time Systems. IEEE Intl. Conf erence on Real-Time and Embedded Technology and Applications Symposium (RTAS), IEEE, 2016.. Best Paper Award
  7. 7. Safety Challenges: Hardware • Hardware bugs – Pentium floating point bug (FDIV bug) – Intel CPU bugs in 2015: • “Certain Combinations of AVX Instructions May Cause Unpredictable System Behavior” • “Processor May Experience a Spurious LLC-Related Machine Check During Periods of High Activity” • … • Transient hardware faults (soft errors) – Single event upset (SEU) in SRAM, logic • Due to alpha particle, cosmic radiation – Manifested as software failures • Crashes, wrong output: silent data corruption – Bigger problem in advanced CPU • Increased density, freq  higher soft error 7
  8. 8. Safety Challenges: Hardware • SRAM SER vs. technology scaling – Per-bit SER decreases – Per-chip SER increases (due to higher density)  Complex hardware is buggy and less reliable 8 Ibe et al., “Scaling Effects on Neutron-Induced Soft Error in SRAMs Down to 22nm Process” (Hitachi)
  9. 9. How to Improve Safety of a System? • Correct by design – Formal method based software development • Difficult for a complex system – Radiation hardened processors • Expensive and low performance • Deal with failures – Run-time monitoring and redundancy 9
  10. 10. Outline • Motivation • UAV Simplex Architecture • Prototype and Case Study 10
  11. 11. Simplex Architecture (*) • Protect an untrusted complex controller with a trusted backup controller • General architectural principal 11 (*) L. Sha, Using Simplicity to Control Complexity, IEEE Software, 2001 Safety Controller Performance Controller UAV Plant Decision Logic Plant
  12. 12. UAV Simplex Architecture • Idea: use two hardware/software platforms with distinct performance and reliability characteristics to realize Simplex 12 High Performance (HP) Platform High Assurance (HA) Platform Safety controller Performance controller UAV Plant Decision Logic GPS,IMU Radar, Camera HA Platform (Arduino) HP Platform: (Tegra TK1) Rich OS (Linux), Middleware (ROS)
  13. 13. Two Platforms • High Assurance (HA) Platform – Simple hardware and software for verification and reliability – Hardware: low frequency and density to reduce SEUs – Software: certifiable, simple, low SLOC • High Performance (HP) Platform – Complex hardware and software for performance – Hardware: performance oriented multicore, multi-gigahz, gpu – Software: productivity oriented software framework, millions SLOC 13
  14. 14. Outline • Motivation • UAV Simplex Architecture • Prototypes and Case Study 14
  15. 15. Prototype Avionics • AFS: our custom built avionics – Arduino based custom DAQ • Basic sensors: IMU, GPS – Nvidia Tegra TK1 • 4 x ARM cores + 192 GPU cores • Advanced sensors: camera, radar • UAVs with the AFS – Applied to four UAVs in Dr. Keshmiri’s lab in KU Aerospace Engineering – Fixed wing (DG 808, G1XD, G1XB) and a Quadcopter 15
  16. 16. UAVs with AFS 16 DG 808G1XB Quadcopter G1XB G1XD
  17. 17. Performance Controller • Hardware – Nvidia Tegra TK1, 4 x ARM Cortex-A15 @ 2.3GHz, 192 core GPU – 28nm process, > a billion transistors  complex, high potential SEUs • Performance controller – Intelligent adaptive non-linear control using advanced sensor packages (goal) – Use Linux (Ubuntu), Robot Operating System (ROS)  difficult to verify 17 ROS nodesRadar Vision Performance controller
  18. 18. Safety Controller • Hardware – Arduino Due, a single ARM Cortex-M3 @ 80MHz – Low density, low operating freq.  less susceptible for SEUs • Safety controller – Matlab Simulink coder + Arduino sketch, no OS small and easier to verify 18 Safety controller (Simulink model)
  19. 19. Decision Logic • Fault models – HA (safety controller, decision logic) is trusted – HP is not trusted • Decision logic – Detect crash, connect failure, timing violation, invalid outputs (e.g., NaN) – Recovery: reboot the HP platform – Limitation: Currently don’t know “unsafe” states 19 Detectable faults
  20. 20. Execution Flow 20 HA platform (Arduino) HP platform (Tegra TK1)
  21. 21. Case Study: Fault (Crash) Injection • Experiment – Kill the performance controller in the middle flight • Hardware-in-the-loop (HIL) setup 21
  22. 22. Case Study: Fault (Crash) Injection 22
  23. 23. Case Study: Fault (Crash) Injection • Monitored from the ground station software 23
  24. 24. Conclusion and Future Work • Safety challenges of intelligent UAVs – Software: increasing complexity, concurrency and timing non-determinism – Hardware: increasing reliability issues. E.g., transient hardware faults (SEUs) • UAV Simplex architecture – Two platform based realization of Simplex • High assurance (HA) platform: simple, verifiable • High performance (HP) platform: performant, unverifiable 24
  25. 25. Conclusion and Future Work • Prototype development and case study – Nvidia Tegra TK1 + Arduino based – Can survive from performance controller crash • Ongoing and Future work – Radar and vision based sense & avoid – Define and detect unsafe state (not just crash) – Detect and recover intrusion (security) – Handling of sensor faults 25
  26. 26. Thank You Disclaimer: This work is supported by the National Aeronautics and Space Administration's (NASA's) Leading Edge Aeronautics Research for NASA (LEARN) fund under grant number NNX15AN94A and Paul G. Allen Family Foundation (PGAFF) grant number KUAE#40956. More details can be found in the following publication. Prasanth Vivekanandan, Gonzalo Garcia, Heechul Yun, Shawn Keshmiri. “A Simplex Architecture for Intelligent and Safe Unmanned Aerial Vehicles.” IEEE International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA), IEEE, 2016 26